Vault password controller for remote resource access authentication

Patent metadata

Field	Value
Publication number	US-11790076-B2
Application number	US-202117337513-A
Country	US
Kind code	B2
Filing date	Jun 3, 2021
Priority date	Jun 3, 2021
Publication date	Oct 17, 2023
Grant date	Oct 17, 2023

Abstract

A computer-implemented method for authenticating a request to access a remote resource includes identifying a request from a first device to access a resource located on a second device. The computer-implemented method further includes retrieving one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device. The computer-implemented method further includes comparing the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device. The computer-implemented method further includes granting the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

First claim

What is claimed is:

1. A computer-implemented method for authenticating a request to access a remote resource, comprising:
identifying a request from a first device to access a resource located on a second device;
retrieving one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device;
comparing the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device; and
granting the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

2. The computer-implemented method of claim 1 , wherein retrieving the one or more encrypted passwords for authenticating access to the resource from the partition of the vault located on the first device is based, at least in part, on a password policy stored in the partition of the vault.

3. The computer-implemented method of claim 1 , further comprising:
initiating, in response to identifying the request from the first device to access the resource located on the second device, an authentication request with the second computing device, wherein the authentication request includes prompting the second device to enter its access credentials for accessing the partition of the vault located on the first device.

4. The computer-implemented method of claim 2 , wherein the access credentials for accessing the partition of the vault located on the first device include: a serial number of the vault, a serial number of the partition of the vault, a vault partition PIN, and a user ID of a user account associated with the resource.

5. The computer-implemented method of claim 1 , further comprising:
establishing, in response to identifying the request from the first device to access the resource located on the second device, a temporary communication channel between the partition of the vault located on the first device and the second device.

6. The computer-implemented method of claim 5 , further comprising:
receiving, while the temporary communication channel is open between the partition of the vault located on the first device and the second device, one or more write operations from the second device; and
storing one or more passwords for authenticating access to the resource in the partition of the vault located on the first device.

7. The computer-implemented method of claim 1 , further comprising:
receiving, while the temporary communication channel is open between the partition of the vault located on the first device and the second device, one or more delete operations from the second device; and
deleting one or more passwords for authenticating access to the resource from the partition of the vault located on the first device.

8. A computer program product, comprising:
one or more computer readable storage media; and
program instructions stored on the one or more computer readable storage media, the program instructions comprising instructions to:
identify a request from a first device to access a resource located on a second device;
retrieve one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device;
compare the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device; and
grant the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

9. The computer program product of claim 8 , wherein the instructions to retrieve the one or more encrypted passwords for authenticating access to the resource from the partition of the vault located on the first device is based, at least in part, on a password policy stored in the partition of the vault.

10. The computer program product of claim 8 , further comprising instructions to:
initiate, in response to identifying the request from the first device to access the resource located on the second device, an authentication request with the second computing device, wherein the authentication request includes prompting the second device to enter its access credentials for accessing the partition of the vault located on the first device.

11. The computer program product of claim 10 , wherein the access credentials for accessing the partition of the vault located on the first device include: a serial number of the vault, a serial number of the partition of the vault, a vault partition PIN, and a user ID of a user account associated with the resource.

12. The computer program product of claim 8 , further comprising instructions to:
establish, in response to identifying the request from the first device to access the resource located on the second device, a temporary communication channel between the partition of the vault located on the first device and the second device.

13. The computer program product of claim 12 , further comprising instructions to:
receive, while the temporary communication channel is open between the partition of the vault located on the first device and the second device, one or more write operations from the second device; and
store one or more passwords for authenticating access to the resource in the partition of the vault located on the first device.

14. The computer program product of claim 12 , further comprising instructions to:
receive, while the temporary communication channel is open between the partition of the vault located on the first device and the second device, one or more delete operations from the second device; and
delete one or more passwords for authenticating access to the resource from the partition of the vault located on the first device.

15. A computer system, the computer system comprising:
one or more computer processors;
one or more computer readable storage media; and
program instructions, the program instructions being stored on the one or more computer readable storage media for execution by the one or more computer processors, the program instructions comprising instructions to:
identify a request from a first device to access a resource located on a second device;
retrieve one or more encrypted passwords for authenticating access to the resource from a partition of a vault located on the first device;
compare the one or more encrypted passwords retrieved from the partition of the vault located on the first device to one or more designated passwords stored on the second device; and
grant the first device access to the resource located on the second device based, at least in part, on the one or more encrypted passwords retrieved from the partition of the vault located on the first device matching the one or more designated passwords stored on the second device.

16. The computer system of claim 15 , wherein the instructions to retrieve the one or more encrypted passwords for authenticating access to the resource from the partition of the vault located on the first device is based, at least in part, on a password policy stored in the partition of the vault.

17. The computer system of claim 15 , further comprising instructions to:
initiate, in respon

Assignees

• IBM

Inventors

• Maresh Mark E
• Whitney Michael J
• Vargas Juan F
• Guenter Erich

Classifications

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title

• H04L63/083 Primary

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• G06F21/31

  User authentication · CPC title